Package: libxenmisc
Version: 4.20.0+68-g35cb38b222-1
Severity: important

    I'm tagging this important because I imagine that not everyone uses USB
on DomU instances.  Since the upgrade to trixie, passthrough USB has
stopped working with Xen instances.  This is critical for us, as one of the
DomU instances needs access to a USB HSM that previously worked in USB
passthrough mode in `bookworm` (Xen 4.17.5).

    When tried to add a hub and a device to a DomU machine, whether it's
manually or in a config file battle-tested with 4.17.5, an error pops:

pa-xen:~# /usr/lib/xen-4.20/bin/xl usbdev-attach test_usb hostbus=2
hostaddr=2
libxl: error: libxl_qmp.c:1837:qmp_ev_parse_error_messages: Domain
7:Parameter 'hostaddr' expects uint64
libxl: error: libxl_device.c:1500:device_addrm_aocomplete: unable to add
device
libxl_device_usbdev_add failed.

    I'm attaching a patch in a subsequent mail to fix this bug, valid
against 4.20-4.20.2.  I haven't sent it upstream yet, but I'll defer to
you.  A Xen instance with a patched libxenmisc1 has been running in
production since November 6th, 2025 without causing any problems.  I'd like
to request an upload to stable-proposed-updates so I don't have to hold the
4.20.2 Xen packages carrying security updates.

    I'll leave some details on how I found out and solved it in case
somebody hits this same problem:

    After much debugging, what happens is that Xen appears to be using a
really old version of QMP (https://wiki.qemu.org/Documentation/QMP), the
JSON protocol that Xen uses to talk to the QEMU instance over a named
pipe.  You can talk to the instance (in this case #10) with a command like
this:

socat - UNIX-CONNECT:/var/run/xen/qmp-libxl-10

    The instance greets you with:

{"QMP": {"version": {"qemu": {"micro": 3, "minor": 0, "major": 10},
"package": "Debian 1:10.0.3+ds-0+deb13u1"}, "capabilities": ["oob"]}}

    If you then try to execute a similar command to the one Xen sends with
libxl:

{"execute": "qmp_capabilities"
}{"execute":"device_add","id":2025,"arguments":{"id":"xenusb-5-2","driver":"usb-host","bus":"xenusb-0.0","port":"1","hostbus":"5","hostaddr":"2"}}
{"return": {}}

    Then you get the error:

{"id": 2025, "error": {"class": "GenericError", "desc": "Parameter
'hostaddr' expects uint64"}}

    Now that you can play back and forth with the message, you can actually
send the value of keys "hostaddr" and "hostbus" as a number, instead of a
string, and it starts working.

    I narrowed it down for now to the creation of the USB controller and
USB individual devices.  I imagine that QEMU was upgraded between bookworm
and trixie, and they deprecated receiving the affected values as
strings. ¯\_(ツ)_/¯

    I still cannot understand how this was still not fixed on upstream's
git HEAD branch as of mid November, when I checked last!  One would think
that USB passthrough was more popular... :-D

    Thanks,


        Ender.

reassign 1129037 libxenmisc4.20 4.20.0+68-g35cb38b222-1
tags 1129037 patch
thanks

    I definitely forgot how to interact with the BTS by e-mail. X-D


        Ender.

Hi Ender,

Thanks for your report and the analysis.

The problem has already been identified and fixed upstream here:
https://gitlab.com/xen-project/xen/-/commit/85e12104f47276b588d5efd33599c987c545eeb1

However the fix only recently landed in the upstream stable 4.20 branch:
https://gitlab.com/xen-project/xen/-/commit/ac333dd662e18e86ffd2afd6c10e04305c9d137b

As such it will automatically be included in the next Debian stable upload of
xen (security update or point release), but unfortunately not yet the upcoming
13.4 point release.

I was also surprised to see that this bug was not noticed earlier. It really
seems like not many people use that feature.

Maxi

We believe that the bug you reported is fixed in the latest version of
xen, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1129037@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hans van Kranenburg <hans@knorrie.org> (supplier of updated xen package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 28 Jul 2026 20:42:50 +0200
Source: xen
Architecture: source
Version: 4.20.3+127-gc42374a105-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Closes: 1129037
Changes:
 xen (4.20.3+127-gc42374a105-1) unstable; urgency=medium
 .
   * Update to new upstream version 4.20.3+127-gc42374a105, which also contains
     security fixes for the following issues:
     (Closes: #1129037)
     - Use after free of paging structures in EPT
       XSA-480 CVE-2026-23554
     - Xenstored DoS by unprivileged domain
       XSA-481 CVE-2026-23555
     - oxenstored keeps quota related use counts across domain destruction
       XSA-483 CVE-2026-23556
     - Xenstored DoS via XS_RESET_WATCHES command
       XSA-484 CVE-2026-23557
     - grant table v2 race in status page mapping
       XSA-486 CVE-2026-23558
     - x86: Floating Point Divider State Sampling
       XSA-488 CVE-2025-54505
     - x86: CPU Opcode Cache corruption
       XSA-490 CVE-2025-54518
     - x86 HVM I/O port list traversal
       XSA-491 CVE-2026-42487
     - domctl lock open to abuse
       XSA-492 CVE-2026-42489 CVE-2026-42490
     - Arm: Completion of memory accesses not guaranteed by completion of a TLBI
       XSA-493 CVE-2025-10263
     - x86: mismatched mapcache metadata
       XSA-494 CVE-2026-42488
     - x86 shadow paging is deprecated
       XSA-495 CVE-2026-42493
     - buffer overruns in libfsimage iso9660 handling
       XSA-497 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424 CVE-2026-62425
     - sysctl and platform-op locks open to abuse
       XSA-499 CVE-2026-62426 CVE-2026-62427
     - grant-table: type confusion in grant-copy
       XSA-500 CVE-2026-62428
     - grant-table: version change racing with other operations
       XSA-501 CVE-2026-62435 CVE-2026-62436
     - vNUMA domain cleanup may race other operations
       XSA-502 CVE-2026-62429
     - x86: Out-of-bounds read in vRTC emulation
       XSA-503 CVE-2026-62430
     - Viridian STIMER division by zero
       XSA-504 CVE-2026-62431
     - evtchn: Race between FIFO expand and reset
       XSA-505 CVE-2026-62432
     - correct buffer checks for DM_OP hypercalls
       XSA-506 CVE-2026-62433
     - PoD: Don't try to reclaim special pages
       XSA-507 CVE-2026-62434
     - pygrub: security-supported only when run de-privileged
       XSA-508
   * Drop the following patches which are now included upstream:
     - ARM: Drop ThumbEE support
     - xen/arm: Set ThumbEE as not present in PFR0
   * Note that the following XSA are not listed, because...
     - XSA-482 has patches for the Linux kernel
     - XSA-485 has patches for the Linux kernel
     - XSA-487 has patches for the Linux kernel
     - XSA-489 applies to XAPI which is not included in Debian
     - XSA-496 only applies to Xen 4.21 and later
     - XSA-498 applies to XAPI which is not included in Debian
Checksums-Sha1:
 7eb0d2019ed088ce46154441d0396c8c2037c977 4154 xen_4.20.3+127-gc42374a105-1.dsc
 db72543f43aa34ac8976c1de1a5ac1746006dc43 4961352 xen_4.20.3+127-gc42374a105.orig.tar.xz
 a5c96e34735baae759dbe47eb26f2c420986441e 139540 xen_4.20.3+127-gc42374a105-1.debian.tar.xz
Checksums-Sha256:
 74299b01a9855f780d8e0b31d56a1bc27f776d73a1926456cac860f3adde48a2 4154 xen_4.20.3+127-gc42374a105-1.dsc
 df0831854a55a8f31cb3cb85036f2edc928e2ef098d77f815f5714bfafac68f3 4961352 xen_4.20.3+127-gc42374a105.orig.tar.xz
 96d44c57b99010618402d0762e3579a58e32c544e3afbe4edb254edb5b96f653 139540 xen_4.20.3+127-gc42374a105-1.debian.tar.xz
Files:
 4b160e197677b6f97da856ca2758f017 4154 admin optional xen_4.20.3+127-gc42374a105-1.dsc
 9b708a84bd7cbcb4483cf794a3672991 4961352 admin optional xen_4.20.3+127-gc42374a105.orig.tar.xz
 b36c7b8aff830ffd648ffb3ee21172d7 139540 admin optional xen_4.20.3+127-gc42374a105-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEESWyddwNaG9637koYssHfcmNhX2wFAmppK18ACgkQssHfcmNh
X2z+eA//Zx48n3To5xItLaNhrzG3V9wJ+s//wPCOFUHCUhdLVsFwQ8OQzszpTlUx
POmqQ33c+5gYSc0tOxCQNG1bGEROCnbdVLC2/HV0s3oAr/lR+MBv+kmqFir1jqo3
pqoGGBV11rZvAp8sXXjPlQMg0B1nSIDEBGKhXVqrgDIzQMeWcpvv5WZVhaqkRZxW
LsRVBj3MQe+Qfeo3hIjRoKXtE0LjPmLYDmhqDDVpn6LnYzxZ9jgeTmohk2eX2+Yy
uheY0S6CbliGIFdjVJJsR+Hx5hx9MNWXf7r7yrIQOrJ7k9mlACzC8+Ib6q02heyJ
9kunQ5hkUqEJz0FP2XmAxE9nxP8ygM0BYbZENlFHI3BzXRtQpqnMwH9mYYXKO4rW
l9iP96bU7TjyJiW4uW5dAZJRSF6h0lQLegH8G98HW9cJFlPcQ8Tru/XxsSwMs/Bh
hRCdRj5XL7Ol3olK07fuAaln/vtkgqhGtr+yw0hZzuFPa4u6K6etKS3dzDA9zk0U
u0ySShk0TOIsNbhmd1x/jH2UfSY3bhV5r1Q7ahoRPhQqcu5JYmK7BJgn6IjNZ7w9
38L+O2zRynSo5TevQzjR+Viskd5BlgtUguXU5aK+eFZ0u3XI6tJHed3Ka4od3pDQ
GX2AzFEOUz+Idc2mU2H0YxgLjT75xtWbM1FYL3Mny0NmMl6Y1f0=
=4J0B
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
xen, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1129037@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Hans van Kranenburg <hans@knorrie.org> (supplier of updated xen package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 31 Jul 2026 23:59:26 +0200
Source: xen
Architecture: source
Version: 4.20.3+127-gc42374a105-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Closes: 1129037
Changes:
 xen (4.20.3+127-gc42374a105-0+deb13u1) trixie-security; urgency=medium
 .
   * Update to new upstream version 4.20.3+127-gc42374a105, which also contains
     security fixes for the following issues:
     (Closes: #1129037)
     - Use after free of paging structures in EPT
       XSA-480 CVE-2026-23554
     - Xenstored DoS by unprivileged domain
       XSA-481 CVE-2026-23555
     - oxenstored keeps quota related use counts across domain destruction
       XSA-483 CVE-2026-23556
     - Xenstored DoS via XS_RESET_WATCHES command
       XSA-484 CVE-2026-23557
     - grant table v2 race in status page mapping
       XSA-486 CVE-2026-23558
     - x86: Floating Point Divider State Sampling
       XSA-488 CVE-2025-54505
     - x86: CPU Opcode Cache corruption
       XSA-490 CVE-2025-54518
     - x86 HVM I/O port list traversal
       XSA-491 CVE-2026-42487
     - domctl lock open to abuse
       XSA-492 CVE-2026-42489 CVE-2026-42490
     - Arm: Completion of memory accesses not guaranteed by completion of a TLBI
       XSA-493 CVE-2025-10263
     - x86: mismatched mapcache metadata
       XSA-494 CVE-2026-42488
     - x86 shadow paging is deprecated
       XSA-495 CVE-2026-42493
     - buffer overruns in libfsimage iso9660 handling
       XSA-497 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424 CVE-2026-62425
     - sysctl and platform-op locks open to abuse
       XSA-499 CVE-2026-62426 CVE-2026-62427
     - grant-table: type confusion in grant-copy
       XSA-500 CVE-2026-62428
     - grant-table: version change racing with other operations
       XSA-501 CVE-2026-62435 CVE-2026-62436
     - vNUMA domain cleanup may race other operations
       XSA-502 CVE-2026-62429
     - x86: Out-of-bounds read in vRTC emulation
       XSA-503 CVE-2026-62430
     - Viridian STIMER division by zero
       XSA-504 CVE-2026-62431
     - evtchn: Race between FIFO expand and reset
       XSA-505 CVE-2026-62432
     - correct buffer checks for DM_OP hypercalls
       XSA-506 CVE-2026-62433
     - PoD: Don't try to reclaim special pages
       XSA-507 CVE-2026-62434
     - pygrub: security-supported only when run de-privileged
       XSA-508
   * Drop the following patches which are now included upstream:
     - ARM: Drop ThumbEE support
     - xen/arm: Set ThumbEE as not present in PFR0
   * Note that the following XSA are not listed, because...
     - XSA-482 has patches for the Linux kernel
     - XSA-485 has patches for the Linux kernel
     - XSA-487 has patches for the Linux kernel
     - XSA-489 applies to XAPI which is not included in Debian
     - XSA-496 only applies to Xen 4.21 and later
     - XSA-498 applies to XAPI which is not included in Debian
 .
 xen (4.20.2+37-g61ff35323e-0+deb13u1) trixie; urgency=medium
 .
   * Update to new upstream version 4.20.2+37-g61ff35323e, which also contains
     security fixes for the following issues:
     - x86: buffer overrun with shadow paging + tracing
       XSA-477 CVE-2025-58150
     - x86: incomplete IBPB for vCPU isolation
       XSA-479 CVE-2026-23553
   * Note that the following XSA are not listed, because...
     - XSA-478 applies to XAPI which is not included in Debian
Checksums-Sha1:
 dbefdd4e57cb83580029c043e5ed8abe21d8fd1c 4061 xen_4.20.3+127-gc42374a105-0+deb13u1.dsc
 db72543f43aa34ac8976c1de1a5ac1746006dc43 4961352 xen_4.20.3+127-gc42374a105.orig.tar.xz
 41425edd82e9c7c6760b46905cd75b928a693ad4 139540 xen_4.20.3+127-gc42374a105-0+deb13u1.debian.tar.xz
Checksums-Sha256:
 659b0858c1559ed7203c09d2eeb6091e50735b78079158ec7e94de573528d6f7 4061 xen_4.20.3+127-gc42374a105-0+deb13u1.dsc
 df0831854a55a8f31cb3cb85036f2edc928e2ef098d77f815f5714bfafac68f3 4961352 xen_4.20.3+127-gc42374a105.orig.tar.xz
 b1f909d626f3d4ba6965ba291dd97b0dfbbe48bb8e2510913cbc1760c5e8cb3e 139540 xen_4.20.3+127-gc42374a105-0+deb13u1.debian.tar.xz
Files:
 ce25ea9a9a2d953006437dee63b6a04f 4061 admin optional xen_4.20.3+127-gc42374a105-0+deb13u1.dsc
 9b708a84bd7cbcb4483cf794a3672991 4961352 admin optional xen_4.20.3+127-gc42374a105.orig.tar.xz
 c861bf1c0396b067c5b040d5fb164687 139540 admin optional xen_4.20.3+127-gc42374a105-0+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmp3DGAACgkQEMKTtsN8
TjamrxAAwEQ5GT89wPUseyBqvX5nwlu2w41jzRHHJTpPb/y1kDagOyW5iFfZLWL/
FxEYjb7BzjLCNsUVVlfUi/H0NMeFzkWwMbik7obcUvxMULHVYl8LBUAK0h+MD5WS
yTPwy4kh3Mih8vfZ9YFIr9bBcOfB7wnz8ADfxsQRBqIZoyjKVcA3nVG3pjZeUKsR
bdwOD8FzHqK6UVYS97tRfJgMqWpAHLI/AshUIn+iy5g0FmSmt3JeJQsw2klFOCAd
589KObPF2nIGgeokFJ8Xotyk9JMXOxor6yzCuMMjjJAHSaq7qC6hvj/lXNkL8ErN
tKdScOZtDHyH5sXS39fAxH+oVv7p0BJvO1EfOiSeY47ckRc42KQmDNGVrOzCP+E8
yUCi58pwQaHT4AiQNhTD8AY4sGbAEMOCIwOarz3aVLKNXEz+zqh3CXY4NFO3waEI
TvEfH8K2j06KJNkg7vWcoRugZ574w7TdIVYuqHLvnFgR7dLZBiyaRL/0qyqWrkvl
NvnIqtuc8G6UwNt6DMXzqwVVBsy/tSdTJlwOhh2ew1F49DuLkDHYuFvudm38qmgH
zXCGbcRDtbly1k9U7ogLGm2zoeOVu5CXN9ONmkan+JrR3ozhQeWDh+CJlIIqkAwN
LAzSXpmpY5H2zxnmTvyuOxBegYVZBVLYxo7wj8+OblVVE//Y3KY=
=wGHr
-----END PGP SIGNATURE-----